CVE-2024-5261
📋 TL;DR
LibreOfficeKit mode in LibreOffice versions before 24.2.4 disables TLS certificate verification when fetching remote resources via curl, allowing man-in-the-middle attacks. This affects third-party applications using LibreOffice as a library for document conversion or viewing. The vulnerability is specific to LibreOfficeKit mode and does not impact standard LibreOffice usage.
💻 Affected Systems
- LibreOffice
📦 What is this software?
Libreoffice by Libreoffice
⚠️ Risk & Real-World Impact
Worst Case
Attackers intercept and manipulate document content, inject malicious code, or steal sensitive data during remote resource fetching, leading to data breaches or system compromise.
Likely Case
Man-in-the-middle attacks result in data tampering or exposure of confidential information in documents fetched from untrusted sources.
If Mitigated
With proper network segmentation and trusted sources, risk is limited to potential data integrity issues in isolated environments.
🎯 Exploit Status
Exploitation depends on network access and the use of LibreOfficeKit to fetch resources from untrusted locations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 24.2.4 or later
Vendor Advisory: https://www.libreoffice.org/about-us/security/advisories/cve-2024-5261
Restart Required: Yes
Instructions:
1. Download LibreOffice version 24.2.4 or newer from the official website. 2. Install the update, replacing the old version. 3. Restart any applications using LibreOfficeKit to apply the fix.
🔧 Temporary Workarounds
Disable LibreOfficeKit Remote Fetching
allPrevent LibreOfficeKit from fetching remote resources by configuring applications to use local resources only.
Configure application settings to disable network access for LibreOfficeKit functions.
🧯 If You Can't Patch
- Restrict network access to only trusted sources for applications using LibreOfficeKit.
- Monitor network traffic for unauthorized TLS interception or unusual connections from LibreOffice processes.
🔍 How to Verify
Check if Vulnerable:
Check if LibreOffice version is below 24.2.4 and confirm LibreOfficeKit mode is enabled in the application.Check Version:
libreoffice --versionVerify Fix Applied:
Verify LibreOffice version is 24.2.4 or higher and test that TLS certificate verification is enabled in LibreOfficeKit mode.📡 Detection & Monitoring
Log Indicators:
- Log entries showing failed TLS certificate validations or warnings in LibreOfficeKit mode.
Network Indicators:
- Unencrypted or suspicious TLS connections from LibreOffice processes to remote servers.
SIEM Query:
Example: source="libreoffice" AND (event="tls_error" OR event="certificate_verification_failed")